{"id":"CVE-2026-42806","state":"PUBLISHED","title":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_al","description":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.","publishedAt":"2026-09-10T09:04:44.607Z","updatedAt":"2026-09-10T15:00:50.874Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"bosch"},"assigner":"bosch","products":["Bosch Sensortec BME690 SensorAPI (C)"],"affected":[{"vendor":"Bosch Sensortec","product":"BME690 SensorAPI (C)","versions":[{"version":"1.0.1","status":"affected","lessThanOrEqual":"1.0.3","versionType":"custom"}]}],"references":["https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/42xxx/CVE-2026-42806.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-42806","state":"PUBLISHED","datePublished":"2026-09-10T09:04:44.607Z","dateUpdated":"2026-09-10T15:00:50.874Z","assignerShortName":"bosch","assignerOrgId":"c95f66b2-7e7c-41c5-8f09-6f86ec68659c","dateReserved":"2026-04-30T08:03:11.875Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c).\r\n\r\nThe driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables.\r\n\r\nWhen parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9).\r\n\r\nAn attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher.\r\n\r\nThis causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer.\r\n\r\nThe leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged."}],"affected":[{"vendor":"Bosch Sensortec","product":"BME690 SensorAPI (C)","versions":[{"version":"1.0.1","status":"affected","lessThanOrEqual":"1.0.3","versionType":"custom"}]}],"references":[{"url":"https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html","name":"https://psirt.bosch.com/security-advisories/BOSCH-SA-223618.html","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en-US","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"bosch","orgId":"c95f66b2-7e7c-41c5-8f09-6f86ec68659c","dateUpdated":"2026-09-10T09:04:44.607Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-10T15:00:33.822497Z","id":"CVE-2026-42806","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-10T15:00:50.874Z"}}]}}}